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THE REPLY FILED 12 November 2004 FAILS TO PLACE THIS APPLICATION IN CONDITION FOR ALLOWANCE. 
Therefore, further action by the applicant is required to avoid abandonment of this application. A proper reply to a 
final rejection under 37 CFR 1.113 may only be either: (1) a timely filed amendment which places the application in 
condition for allowance; (2) a timely filed Notice of Appeal (with appeal fee); or (3) a timely filed Request for Continued 
Examination (RCE) in compliance with 37 CFR 1.114. 

PERIOD FOR REPLY [check either a) or b)] 

a) ^ The period for reply expires 3_months from the mailing date of the final rejection. 

b) CD The period for reply expires on: (1 ) the mailing date of this Advisory Action, or (2) the date set forth in the final rejection, whichever is later. In 

no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of the final rejection. 

ONLY CHECK THIS BOX WHEN THE FIRST REPLY WAS FILED WITHIN TWO MONTHS OF THE FINAL REJECTION. See MPEP 

706.07(f). 

Extensions of time may be obtained under 37 CFR 1.136(a). The date on which the petition under 37 CFR 1.136(a) and the appropriate extension 
fee have been filed is the date for purposes of determining the period of extension and the corresponding amount of the fee. The appropriate extension 
fee under 37 CFR 1.17(a) is calculated from: (1) the expiration date of the shortened statutory period for reply originally set in the final Office action; or 
(2) as set forth in (b) above, if checked. Any reply received by the Office later than three months after the mailing date of the final rejection, even if 
timely filed, may reduce any earned patent term adjustment. See 37 CFR 1.704(b). 

1 .□ A Notice of Appeal was filed on . Appellant's Brief must be filed within the period set forth in 

37 CFR 1.192(a), or any extension thereof (37 CFR 1.191(d)), to avoid dismissal of the appeal. 

2. Q The proposed amendment(s) will not be entered because: 

(a) □ they raise new issues that would require further consideration and/or search (see NOTE below); 

(b) □ they raise the issue of new matter (see Note below); 

(c) □ they are not deemed to place the application in better form for appeal by materially reducing or simplifying the 

issues for appeal; and/or 

(d) □ they present additional claims without canceling a corresponding number of finally rejected claims. 

NOTE: . 

3. D Applicant's reply has overcome the following rejection(s): . 

4. Q Newly proposed or amended claim(s) would be allowable if submitted in a separate, timely filed amendment 

canceling the non-allowable claim(s). 

5. ^ The a)Q affidavit, b)D exhibit, or c)£3 request for reconsideration has been considered but does NOT place the 

application in condition for allowance because: See attachment 

6. D The affidavit or exhibit will NOT be considered because it is not directed SOLELY to issues which were newly 

raised by the Examiner in the final rejection. 

7. ^3 For purposes of Appeal, the proposed amendment(s) a)D will not be entered or b)S will be entered and an 

explanation of how the new or amended claims would be rejected is provided below or appended. 

The status of the claim(s) is (or will be) as follows: 
Claim(s) allowed: NONE . 
Claim(s) objected to: NONE . 
Claim(s) rejected: 1-3 and 5-9 . 
Claim(s) withdrawn from consideration: NONE . 

8. Q The drawing correction filed on is a)D approved or b)D disapproved by the Examiner. 

9. Q Note the attached Information Disclosure Statement(s)( PTO-1449) Paper No(s). . ' 

10. S Other: See attachment 
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Advisory Action 

1. This office action is in response to the after-final request for reconsideration filed 
on November 12, 2004. Applicant's request for consideration has been fully considered 
but they are not persuasive because of the following reasons: 

The applicant in regards to claim 1 , argue that the cited prior art (CPA) [Chang 
U.S. Patent 6,105,012, hereinafter "Chang"] does not disclose, "a method for 
automatically operating a decryption function within a web site page" and "providing the 
data within said web site page for validating an associated key for said cryptogram". 

Examiner disagrees and directs the Applicant to Chang Column 2 lines 20 - 45; 
Column 9 lines 5-51 and Column 12 lines 37-49, wherein Chang teaches a method 
for automatically operating a decryption function within a web site page and providing 
the data within said web site page for validating an associated key for said encrypted 
HTML form (cryptogram), a session key (associated key) is generated where a 
password mechanism is used for access control. Applicant discloses that a web site 
page is a web site HTML document (Applicant specification page 4 "... a web site HTML 
document will be referred to as a "page"; ...); the decryption functions are loaded into 
the browser environment which are to operate when the cryptogram packages are 
downloaded by the browser (Applicant specification page 5-6, "All process functions in 
page 100 are loaded into the browser ...and cryptogram packages are downloaded by 
browser") and an associated key as a key that is generated using a viewer-entered key 
(Applicant specification page 4, "... a viewer-entered, clear text key ..." and page 9 "If a 
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showkey was entered .... established earlier"). Examiner maintains that Chang clearly 
teaches, as described above a method for automatically operating a decryption function 
within a web site page for validating an associated key for said cryptogram. 

The applicant in regards to the amended claim 2, argue that the Chang does not 
disclose "the availability of a plurality of said decrypted versions within each said web 
site page in a plurality of said web site pages in a web site, whereby all said decrypted 
versions are available for display in the original position of their corresponding said 
cryptograms within said web site". 

Examiner disagrees and directs the Applicant to Chang Column 8 lines 7-20 
wherein, Chang teaches that once the user has established a session, the user can 
access plurality of decrypted version of HTML forms and the format of the forms varies 
depending the transaction type which include both encrypted forms and non-encrypted 
forms. Chang further discloses "If the transmission was a request for one or more web 
pages, the session key is used to decrypt the HTML form data (Chang Column 9 lines 
49 - 53). Examiner maintains that Chang teaches the availability of a plurality of said 
decrypted versions within each said web site page in a plurality of said web site pages 
in a web site, whereby all said decrypted versions are available for display in the original 
position of their corresponding said cryptograms within said web site. 
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The applicant in regards to claim 3, argue that the cited prior art Chang does not 
disclose, "a cryptogram is of any size up to the size allowed by HTML standards for the 
body of said web site page". 

Examiner disagrees and directs the Applicant to Chang Column 2 lines 30 - 38 
and Column 4 lines 2 - 20, wherein Chang discloses that the web pages can include 
HTML documents or HTML documents with HTML forms. Examiner maintains that 
Chang teaches a cryptogram is of any size up to the size allowed by HTML standards 
for the body of said web site page. 

The applicant in regards to claim 5, argue that the Chang does not disclose 
"decryption function obtains said associated key from a plurality of said associated keys, 
whereby each of said plurality of said web site pages contains within itself the means for 
independently decrypting a plurality of said cryptograms". 

Examiner disagrees and directs the Applicant to Chang teaches a key generation 
procedure to generate plurality of sessions keys and session key is used to decrypt 
HTML documents (Chang Column 5 lines 20 - 45) and also Chang teaches that the 
user can request one or more forms that are encrypted (cryptograms) which are 
decrypted using a session key (associated key). Examiner maintains that Chang 
teaches decryption function obtaining an associated key from a plurality of said 
associated keys, whereby each of said plurality of said web site pages contains within 
itself the means for independently decrypting a plurality of said cryptograms. 
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The applicant in regards to claim 6, argue that the Chang does not disclose "a 
human operator provides said plurality of said associated keys, comprising: a first 
means for sending an input request to said human operator, a second means for 
receiving said plurality of said associated keys directly into said web site page" and 
"allow a human operator to determine which of said plurality of said cryptograms are 
decrypted". 

Examiner disagrees and directs that Applicant to Chang Column 5 lines 23 - 45 
and Column 6 lines 57 - 64, wherein Chang discloses providing plurality of sessions 
keys (associated keys) and receiving said plurality of said session keys directly into web 
browser (web pages). Although Chang does not specifically discloses a human 
operator, server itself is maintained and operated by human and therefore human 
operator manages key transmission and web site management. 

Examiner maintains that Chang teaches a human operator provides said plurality 
of said associated keys, comprising: a first means for sending an input request to said 
human operator, a second means for receiving said plurality of said associated keys 
directly into said web site page" and "allow a human operator to determine which of said 
plurality of said cryptograms are decrypted. 

The applicant in regards to claim 7, argue that Chang does not disclose "human 
operator receives a validity report directly from said decryption function upon entry of 
each said associated key, whereby said human operator is afforded the convenience of 
receiving notices of the validity of each said key from said web site page itself. 
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Examiner maintains (see Claim 6 reasons for human operator) that Chang 
teaches human operator receives a validity report directly from said decryption function 
upon entry of each said associated key, whereby said human operator is afforded the 
convenience of receiving notices of the validity of each said key from said web site page 
itself (Column 1 1 line 60 - Column 1 2 line 1 0). 

The applicant in regards to claim 8, argue that Chang does not disclose "plurality 
of associated keys are made available to said plurality of said web site pages in said 
web site, comprising: a frameset page which will establish communication between said 
plurality of said web site pages if not already established", "a third means which will 
distribute said plurality of said associated keys to all said web site pages as they are 
displayed" and "the convenience of entering said plurality of said associated keys in a 
single declaration". 

Examiner maintains (see Claim 6 reasons for human operator) that Chang 
teaches plurality of associated keys are made available to said plurality of said web site 
pages in said web site, comprising: a frameset page which will establish communication 
between said plurality of said web site pages if not already established, a third means 
which will distribute said plurality of said associated keys to all said web site pages as 
they are displayed and the convenience of entering said plurality of said associated 
keys in a single declaration (Column 1 line 66 - Column 2 line 55). 
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The applicant in regards to claim 9, argue that Chang does not disclose "wherein 
said decryption function operates only on the first instance of said cryptogram being 
found within said web site, whereby said human operator is requested to enter said 
plurality of said associated keys only if an instance of said web site page is encountered 
while said human operator is browsing said web site". 

Examiner maintains (see Claim 6 reasons for human operator) that Chang 
teaches a method for automatically operating a decryption function within a web site 
page wherein said decryption function operates only on the first instance of said 
cryptogram being found within said web site, whereby said human operator is requested 
to enter said plurality of said associated keys only if an instance of said web site page is 
encountered while said human operator is browsing said web site (Column 2 lines 56 - 
66 and Column 8 line 60 - Column 9 line 3). 

2. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Pramila Parthasarathy whose telephone number is 571- 
272-3866. The examiner can normally be reached on Monday - Friday (8:00am - 5pm). 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.qov.Should you 
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have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-21 7-9197 (toll-free). 

Pramila Parthasarathy 
December 16, 2004. 
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